CVE-2017-10792: There is a NULL Pointer Dereference in the function ll_insert() of the libpspp library in GNU PSPP before 0...

Security readout for executives and security teams

CVE-2017-10792 is a crash bug in GNU PSPP before 0.11.0. A malformed SPSS data file can trigger a NULL pointer dereference while PSPP converts data, such as SPSS to CSV. Business impact is denial of service for workflows or services that process untrusted statistical files. Exposure is most likely where GNU PSPP, or software embedding libpspp, processes SPSS files from users, partners, email, uploads, or automated pipelines. Systems using PSPP only for trusted local files have lower practical exposure. Prioritize based on whether PSPP handles untrusted files. Internet-facing or partner-facing conversion services should be remediated promptly; internal trusted-only analytics workstations are lower urgency but should still be updated during normal maintenance. Mitigation focus: Identify GNU PSPP and libpspp installations in servers, containers, and data-processing jobs.; Replace GNU PSPP versions before 0.11.0 where supported by your package source.; Restrict PSPP processing to trusted files until vendor guidance is confirmed..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.